@datadog/flagging-core

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the package-to-source relationship is less transparent and deserves caution despite the organization match.

Security policycaution

The repository has no SECURITY.md or other declared security policy, leaving disclosure and response procedures unclear.

Workflow auditcaution

All 5 workflows were analyzed with no untrusted checkouts or script-injection sinks, but 3 workflows grant top-level write access and high-confidence bot-condition and template-injection findings remain hygiene concerns; the low-confidence cache findings carry little weight.